I think a more potent example is who controls the source for the spec and official implementations. This is a notable lack of community governance around this part. In this sense, Bluesky can and does change things at will. I have experienced breaking changes from their devs changing how things work and merging their own PRs in a matter of minutes, while not using versions. (indigo)

When it comes to private/permissioned data, Bluesky people have decided the shape it will take while not participating in the conversation until they shared their already decided upon design. They are letting the community give feedback, but the community never was able to participate in the design phase.

Who owns it?